From addeaf18d21e708f1b226b4d564ded10d371f215 Mon Sep 17 00:00:00 2001 From: Hermes Agent Date: Fri, 17 Jul 2026 12:37:10 -0500 Subject: [PATCH] test(#795): make PR diff fixtures hermetic --- .../tools/codex/test-pr-diff-context.sh | 207 +++++++++--------- 1 file changed, 106 insertions(+), 101 deletions(-) diff --git a/packages/mosaic/framework/tools/codex/test-pr-diff-context.sh b/packages/mosaic/framework/tools/codex/test-pr-diff-context.sh index db1d568..5189358 100644 --- a/packages/mosaic/framework/tools/codex/test-pr-diff-context.sh +++ b/packages/mosaic/framework/tools/codex/test-pr-diff-context.sh @@ -1,5 +1,5 @@ #!/bin/bash -# Regression coverage for Gitea PR diff construction and fail-closed review behavior. +# Hermetic regression coverage for Gitea PR diff construction and fail-closed reviews. set -euo pipefail SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" @@ -13,108 +13,60 @@ fail() { assert_contains() { local haystack="$1" needle="$2" - [[ "$haystack" == *"$needle"* ]] || fail "expected output to contain: $needle" + if [[ "$haystack" != *"$needle"* ]]; then + printf 'actual output:\n%s\n' "$haystack" >&2 + fail "expected output to contain: $needle" + fi } -# A fresh clone's local HEAD is unrelated to PR #795, whose changes target the -# synthetic non-main base release/next and exist only at the provider PR ref. -# The git stub returns the PR patch only for those two explicit fetched refs. -if [[ "${1:-all}" != "fail-closed" ]]; then - FETCH_LOG="$TMP_DIR/fetch.log" - DIFF_LOG="$TMP_DIR/diff.log" - export FETCH_LOG DIFF_LOG +# Prevent CI-provided repository context from leaking into the fixture repositories. +unset GIT_DIR GIT_WORK_TREE GIT_INDEX_FILE GIT_OBJECT_DIRECTORY \ + GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR +export GIT_AUTHOR_NAME="Codex Fixture" +export GIT_AUTHOR_EMAIL="codex-fixture@example.test" +export GIT_COMMITTER_NAME="$GIT_AUTHOR_NAME" +export GIT_COMMITTER_EMAIL="$GIT_AUTHOR_EMAIL" +export GITEA_LOGIN="fixture" +export GITEA_TOKEN="fixture-token" +export GITEA_URL="file://$TMP_DIR" - ( - # shellcheck source=common.sh - source "$SCRIPT_DIR/common.sh" +create_pr_fixture() { + local fixture_root="$1" head_mode="$2" + local origin="$fixture_root/origin.git" + local seed="$fixture_root/seed" + local work="$fixture_root/work" + local base_sha head_sha - detect_platform() { - PLATFORM=gitea - export PLATFORM - } + mkdir -p "$fixture_root" + git init --quiet --bare "$origin" + git init --quiet --initial-branch=release/next "$seed" + printf 'base\n' > "$seed/pr-change.ts" + git -C "$seed" add pr-change.ts + git -C "$seed" commit --quiet -m "fixture base" + base_sha=$(git -C "$seed" rev-parse HEAD) + git -C "$seed" remote add origin "$origin" + git -C "$seed" push --quiet origin release/next + git --git-dir="$origin" symbolic-ref HEAD refs/heads/release/next - tea() { - if [[ "$*" == "pr list --fields index,base --output simple" ]]; then - printf '795 release/next\n' - return 0 - fi - return 1 - } - - git() { - case "${1:-}" in - remote) - printf 'https://git.example.test/mosaicstack/stack.git\n' - ;; - fetch) - printf '%s\n' "$*" >> "$FETCH_LOG" - ;; - diff) - printf '%s\n' "$*" >> "$DIFF_LOG" - if [[ "$*" == *"refs/remotes/origin/release/next...refs/remotes/origin/pr/795/head"* && "$*" != *"HEAD"* ]]; then - cat <<'DIFF' -diff --git a/pr-change.ts b/pr-change.ts ---- a/pr-change.ts -+++ b/pr-change.ts -@@ -1 +1 @@ --old -+actual-pr-change -DIFF - fi - ;; - *) - return 1 - ;; - esac - } - - diff_context=$(build_diff_context pr 795) - assert_contains "$diff_context" "actual-pr-change" - ) - - assert_contains "$(cat "$FETCH_LOG" 2>/dev/null || true)" "refs/heads/release/next:refs/remotes/origin/release/next" - assert_contains "$(cat "$FETCH_LOG" 2>/dev/null || true)" "refs/pull/795/head" - assert_contains "$(cat "$DIFF_LOG" 2>/dev/null || true)" "refs/remotes/origin/release/next...refs/remotes/origin/pr/795/head" - if grep -q 'HEAD' "$DIFF_LOG" 2>/dev/null; then - fail "Gitea PR diff used local HEAD" + if [[ "$head_mode" == "changed" ]]; then + git -C "$seed" switch --quiet -c feature/pr-795 + printf 'actual-pr-change\n' > "$seed/pr-change.ts" + git -C "$seed" commit --quiet -am "fixture PR head" + head_sha=$(git -C "$seed" rev-parse HEAD) + git -C "$seed" push --quiet origin HEAD:refs/pull/795/head + else + head_sha="$base_sha" + git --git-dir="$origin" update-ref refs/pull/795/head "$head_sha" fi - echo "ok - Gitea PR mode fetches and diffs explicit non-main base and PR head refs" -fi -# Exercise both CLI paths with all provider/network mutations stubbed. An empty -# PR diff must fail before Codex runs and before either auto-post path can run. -if [[ "${1:-all}" != "pr-head" ]]; then - SANDBOX="$TMP_DIR/sandbox" - mkdir -p "$SANDBOX/tools/codex/schemas" "$SANDBOX/tools/git" "$SANDBOX/bin" - cp "$SCRIPT_DIR/common.sh" \ - "$SCRIPT_DIR/codex-code-review.sh" \ - "$SCRIPT_DIR/codex-security-review.sh" \ - "$SANDBOX/tools/codex/" - cp "$SCRIPT_DIR/schemas/code-review-schema.json" \ - "$SCRIPT_DIR/schemas/security-review-schema.json" \ - "$SANDBOX/tools/codex/schemas/" + # Gitea's provider-owned PR head ref now exists in the local bare origin. + git clone --quiet "$origin" "$work" + printf '%s\n' "$work" +} - cat > "$SANDBOX/tools/git/detect-platform.sh" <<'STUB' -detect_platform() { PLATFORM=gitea; export PLATFORM; } -get_repo_info() { printf 'mosaicstack/stack\n'; } -STUB - cat > "$SANDBOX/tools/git/pr-review.sh" <<'STUB' -#!/bin/bash -printf 'POST %s\n' "$*" >> "$POST_LOG" -STUB - chmod +x "$SANDBOX/tools/git/pr-review.sh" - - cat > "$SANDBOX/bin/git" <<'STUB' -#!/bin/bash -case "${1:-}" in - rev-parse) exit 0 ;; - remote) printf 'https://git.example.test/mosaicstack/stack.git\n' ;; - fetch) printf 'FETCH %s\n' "$*" >> "$FETCH_LOG" ;; - diff) exit 0 ;; - *) exit 1 ;; -esac -STUB - cat > "$SANDBOX/bin/tea" <<'STUB' +FAKE_BIN="$TMP_DIR/bin" +mkdir -p "$FAKE_BIN" +cat > "$FAKE_BIN/tea" <<'STUB' #!/bin/bash if [[ "$*" == "pr list --fields index,base --output simple" ]]; then printf '795 release/next\n' @@ -122,12 +74,62 @@ if [[ "$*" == "pr list --fields index,base --output simple" ]]; then fi exit 1 STUB - cat > "$SANDBOX/bin/codex" <<'STUB' +cat > "$FAKE_BIN/codex" <<'STUB' #!/bin/bash printf 'CODEX %s\n' "$*" >> "$CODEX_LOG" exit 99 STUB - chmod +x "$SANDBOX/bin/git" "$SANDBOX/bin/tea" "$SANDBOX/bin/codex" +chmod +x "$FAKE_BIN/tea" "$FAKE_BIN/codex" +export PATH="$FAKE_BIN:$PATH" + +# The valid fixture is a fresh clone on the non-main base. The PR head exists only +# at refs/pull/795/head, so local HEAD cannot accidentally satisfy the assertion. +if [[ "${1:-all}" != "fail-closed" ]]; then + VALID_WORK=$(create_pr_fixture "$TMP_DIR/valid" changed) + ( + cd "$VALID_WORK" + # shellcheck source=common.sh + source "$SCRIPT_DIR/common.sh" + diff_context=$(build_diff_context pr 795) + assert_contains "$diff_context" "actual-pr-change" + + base_sha=$(git rev-parse refs/remotes/origin/release/next) + head_sha=$(git rev-parse refs/remotes/origin/pr/795/head) + local_sha=$(git rev-parse HEAD) + [[ "$local_sha" == "$base_sha" ]] || fail "fixture clone is not on the PR base" + [[ "$head_sha" != "$base_sha" ]] || fail "fixture PR head does not differ from its base" + git show-ref --verify --quiet refs/remotes/origin/pr/795/head || \ + fail "fetched PR head ref is missing" + [[ "$(git diff --name-only "${base_sha}...${head_sha}")" == "pr-change.ts" ]] || \ + fail "explicit PR refs do not contain the fixture change" + if git show-ref --verify --quiet refs/heads/main || \ + git show-ref --verify --quiet refs/remotes/origin/main; then + fail "fixture unexpectedly contains a main ref" + fi + ) + echo "ok - Gitea PR mode fetches and diffs explicit non-main base and PR head refs" +fi + +# Build an empty PR entirely inside another local repository. Both review wrappers +# must emit the PR-numbered error before Codex or the stubbed post path can execute. +if [[ "${1:-all}" != "pr-head" ]]; then + EMPTY_WORK=$(create_pr_fixture "$TMP_DIR/empty" empty) + SANDBOX="$TMP_DIR/sandbox" + mkdir -p "$SANDBOX/tools/codex/schemas" "$SANDBOX/tools/git" + cp "$SCRIPT_DIR/common.sh" \ + "$SCRIPT_DIR/codex-code-review.sh" \ + "$SCRIPT_DIR/codex-security-review.sh" \ + "$SANDBOX/tools/codex/" + cp "$SCRIPT_DIR/schemas/code-review-schema.json" \ + "$SCRIPT_DIR/schemas/security-review-schema.json" \ + "$SANDBOX/tools/codex/schemas/" + cp "$SCRIPT_DIR/../git/detect-platform.sh" "$SANDBOX/tools/git/" + + cat > "$SANDBOX/tools/git/pr-review.sh" <<'STUB' +#!/bin/bash +printf 'POST %s\n' "$*" >> "$POST_LOG" +STUB + chmod +x "$SANDBOX/tools/git/pr-review.sh" POST_LOG="$TMP_DIR/post.log" CODEX_LOG="$TMP_DIR/codex.log" @@ -138,16 +140,19 @@ STUB : > "$CODEX_LOG" review_script="$SANDBOX/tools/codex/codex-${review_kind}-review.sh" set +e - PATH="$SANDBOX/bin:$PATH" "$review_script" -n 795 \ - >"$TMP_DIR/${review_kind}.stdout" 2>"$TMP_DIR/${review_kind}.stderr" + ( + cd "$EMPTY_WORK" + "$review_script" -n 795 + ) >"$TMP_DIR/${review_kind}.stdout" 2>"$TMP_DIR/${review_kind}.stderr" review_status=$? set -e + stderr_text=$(cat "$TMP_DIR/${review_kind}.stderr") [[ "$review_status" -ne 0 ]] || fail "${review_kind} review returned success for an empty PR diff" [[ ! -s "$CODEX_LOG" ]] || fail "Codex ran for an empty ${review_kind} PR diff" [[ ! -s "$POST_LOG" ]] || fail "${review_kind} review auto-post ran for an empty PR diff" - assert_contains "$(cat "$TMP_DIR/${review_kind}.stderr")" "Error:" - assert_contains "$(cat "$TMP_DIR/${review_kind}.stderr")" "PR #795" + assert_contains "$stderr_text" "Error:" + assert_contains "$stderr_text" "PR #795" echo "ok - empty ${review_kind} PR diff fails closed before Codex and auto-post" done fi